* FAILED: patch "[PATCH] drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR" failed to apply to 6.18-stable tree
@ 2026-05-15 8:39 gregkh
2026-07-31 15:50 ` [PATCH 6.18.y 1/3] drm/xe/xe3p_lpg: flush shrinker bo cachelines manually Sasha Levin
0 siblings, 1 reply; 4+ messages in thread
From: gregkh @ 2026-05-15 8:39 UTC (permalink / raw)
To: jia.yao, alwin.mathew, matthew.auld, matthew.brost, michal.mrozek,
rodrigo.vivi, shuicheng.lin, stable
Cc: stable
The patch below does not apply to the 6.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.18.y
git checkout FETCH_HEAD
git cherry-pick -x 662f9ddc8077792129440d05cbef2f944a07777a
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026051515-treble-unwieldy-f489@gregkh' --subject-prefix 'PATCH 6.18.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 662f9ddc8077792129440d05cbef2f944a07777a Mon Sep 17 00:00:00 2001
From: Jia Yao <jia.yao@intel.com>
Date: Fri, 17 Apr 2026 05:59:17 +0000
Subject: [PATCH] drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR
Add validation in xe_vm_bind_ioctl() to reject PAT indices
with XE_COH_NONE coherency mode when used with
DRM_XE_VM_BIND_FLAG_CPU_ADDR_MIRROR.
CPU address mirror mappings use system memory that is CPU
cached, which makes them incompatible with COH_NONE PAT
indices. Allowing COH_NONE with CPU cached buffers is a
security risk, as the GPU may bypass CPU caches and read
stale sensitive data from DRAM.
Although CPU_ADDR_MIRROR does not create an immediate
mapping, the backing system memory is still CPU cached.
Apply the same PAT coherency restrictions as
DRM_XE_VM_BIND_OP_MAP_USERPTR.
v2:
- Correct fix tag
v6:
- No change
v7:
- Correct fix tag
v8:
- Rebase
v9:
- Limit the restrictions to iGPU
v10:
- Just add the iGPU logic but keep dGPU logic
Fixes: b43e864af0d4 ("drm/xe/uapi: Add DRM_XE_VM_BIND_FLAG_CPU_ADDR_MIRROR")
Cc: <stable@vger.kernel.org> # v6.15+
Cc: Shuicheng Lin <shuicheng.lin@intel.com>
Cc: Mathew Alwin <alwin.mathew@intel.com>
Cc: Michal Mrozek <michal.mrozek@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Matthew Auld <matthew.auld@intel.com>
Signed-off-by: Jia Yao <jia.yao@intel.com>
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Acked-by: Michal Mrozek <michal.mrozek@intel.com>
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Link: https://patch.msgid.link/20260417055917.2027459-3-jia.yao@intel.com
(cherry picked from commit 4d58d7535e826a3175527b6174502f0db319d7f6)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
index 1720205c09ca..a717a2b8dea3 100644
--- a/drivers/gpu/drm/xe/xe_vm.c
+++ b/drivers/gpu/drm/xe/xe_vm.c
@@ -3658,6 +3658,8 @@ static int vm_bind_ioctl_check_args(struct xe_device *xe, struct xe_vm *vm,
op == DRM_XE_VM_BIND_OP_MAP_USERPTR) ||
XE_IOCTL_DBG(xe, coh_mode == XE_COH_NONE &&
op == DRM_XE_VM_BIND_OP_MAP_USERPTR) ||
+ XE_IOCTL_DBG(xe, !IS_DGFX(xe) && coh_mode == XE_COH_NONE &&
+ is_cpu_addr_mirror) ||
XE_IOCTL_DBG(xe, xe_device_is_l2_flush_optimized(xe) &&
(op == DRM_XE_VM_BIND_OP_MAP_USERPTR ||
is_cpu_addr_mirror) &&
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH 6.18.y 1/3] drm/xe/xe3p_lpg: flush shrinker bo cachelines manually
2026-05-15 8:39 FAILED: patch "[PATCH] drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR" failed to apply to 6.18-stable tree gregkh
@ 2026-07-31 15:50 ` Sasha Levin
2026-07-31 15:50 ` [PATCH 6.18.y 2/3] drm/xe/pat: define coh_mode 2way Sasha Levin
2026-07-31 15:50 ` [PATCH 6.18.y 3/3] drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR Sasha Levin
0 siblings, 2 replies; 4+ messages in thread
From: Sasha Levin @ 2026-07-31 15:50 UTC (permalink / raw)
To: stable; +Cc: Tejas Upadhyay, Thomas Hellström, Sasha Levin
From: Tejas Upadhyay <tejas.upadhyay@intel.com>
[ Upstream commit 4e7ebff69aed345f65f590a17b3119c0cb5eadde ]
XA, new pat_index introduced post xe3p_lpg, is memory shared between the
CPU and GPU is treated differently from other GPU memory when the Media
engine is power-gated.
XA is *always* flushed, like at the end-of-submssion (and maybe other
places), just that internally as an optimisation hw doesn't need to make
that a full flush (which will also include XA) when Media is
off/powergated, since it doesn't need to worry about GT caches vs Media
coherency, and only CPU vs GPU coherency, so can make that flush a
targeted XA flush, since stuff tagged with XA now means it's shared with
the CPU. The main implication is that we now need to somehow flush non-XA
before freeing system memory pages, otherwise dirty cachelines could be
flushed after the free (like if Media suddenly turns on and does a full
flush)
V4: Add comments for L2 flush path
V3(Thomas/MattA/MattR): Restrict userptr with non-xa, then no need to
flush manually
V2(MattA): Expand commit description
Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Link: https://patch.msgid.link/20260305121902.1892593-7-tejas.upadhyay@intel.com
Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
Stable-dep-of: 662f9ddc8077 ("drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/xe/xe_bo.c | 7 ++++++-
drivers/gpu/drm/xe/xe_device.c | 23 +++++++++++++++++++++++
drivers/gpu/drm/xe/xe_device.h | 1 +
3 files changed, 30 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
index 0dabe8535139..116e6ae61a83 100644
--- a/drivers/gpu/drm/xe/xe_bo.c
+++ b/drivers/gpu/drm/xe/xe_bo.c
@@ -643,7 +643,12 @@ static int xe_bo_trigger_rebind(struct xe_device *xe, struct xe_bo *bo,
if (!xe_vm_in_fault_mode(vm)) {
drm_gpuvm_bo_evict(vm_bo, true);
- continue;
+ /*
+ * L2 cache may not be flushed, so ensure that is done in
+ * xe_vm_invalidate_vma() below
+ */
+ if (!xe_device_is_l2_flush_optimized(xe))
+ continue;
}
if (!idle) {
diff --git a/drivers/gpu/drm/xe/xe_device.c b/drivers/gpu/drm/xe/xe_device.c
index 0d69cd0e4e79..ee2da75d6290 100644
--- a/drivers/gpu/drm/xe/xe_device.c
+++ b/drivers/gpu/drm/xe/xe_device.c
@@ -1052,6 +1052,29 @@ static void tdf_request_sync(struct xe_device *xe)
}
}
+/**
+ * xe_device_is_l2_flush_optimized - if L2 flush is optimized by HW
+ * @xe: The device to check.
+ *
+ * Return: true if the HW device optimizing L2 flush, false otherwise.
+ */
+bool xe_device_is_l2_flush_optimized(struct xe_device *xe)
+{
+ /* XA is *always* flushed, like at the end-of-submssion (and maybe other
+ * places), just that internally as an optimisation hw doesn't need to make
+ * that a full flush (which will also include XA) when Media is
+ * off/powergated, since it doesn't need to worry about GT caches vs Media
+ * coherency, and only CPU vs GPU coherency, so can make that flush a
+ * targeted XA flush, since stuff tagged with XA now means it's shared with
+ * the CPU. The main implication is that we now need to somehow flush non-XA before
+ * freeing system memory pages, otherwise dirty cachelines could be flushed after the free
+ * (like if Media suddenly turns on and does a full flush)
+ */
+ if (GRAPHICS_VER(xe) >= 35 && !IS_DGFX(xe))
+ return true;
+ return false;
+}
+
void xe_device_l2_flush(struct xe_device *xe)
{
struct xe_gt *gt;
diff --git a/drivers/gpu/drm/xe/xe_device.h b/drivers/gpu/drm/xe/xe_device.h
index 32cc6323b7f6..0cdab55a1890 100644
--- a/drivers/gpu/drm/xe/xe_device.h
+++ b/drivers/gpu/drm/xe/xe_device.h
@@ -179,6 +179,7 @@ void xe_device_snapshot_print(struct xe_device *xe, struct drm_printer *p);
u64 xe_device_canonicalize_addr(struct xe_device *xe, u64 address);
u64 xe_device_uncanonicalize_addr(struct xe_device *xe, u64 address);
+bool xe_device_is_l2_flush_optimized(struct xe_device *xe);
void xe_device_td_flush(struct xe_device *xe);
void xe_device_l2_flush(struct xe_device *xe);
--
2.53.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH 6.18.y 2/3] drm/xe/pat: define coh_mode 2way
2026-07-31 15:50 ` [PATCH 6.18.y 1/3] drm/xe/xe3p_lpg: flush shrinker bo cachelines manually Sasha Levin
@ 2026-07-31 15:50 ` Sasha Levin
2026-07-31 15:50 ` [PATCH 6.18.y 3/3] drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR Sasha Levin
1 sibling, 0 replies; 4+ messages in thread
From: Sasha Levin @ 2026-07-31 15:50 UTC (permalink / raw)
To: stable; +Cc: Tejas Upadhyay, Matthew Auld, Sasha Levin
From: Tejas Upadhyay <tejas.upadhyay@intel.com>
[ Upstream commit 411389d29eab5325e2b250b1cd2ddb567abb7bbb ]
Defining 2way (two-way coherency) is critical for
Xe3p_LPG (Nova Lake P) platforms to support L2 flush
optimization safely.
This mode allows the driver to skip certain manual cache
flushes (L2 flush optimization) without risking memory
corruption because the hardware ensures the most recent
data is visible to both entities.
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Link: https://patch.msgid.link/20260305121902.1892593-8-tejas.upadhyay@intel.com
Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
Stable-dep-of: 662f9ddc8077 ("drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/xe/xe_pat.c | 14 +++++++-------
drivers/gpu/drm/xe/xe_pat.h | 5 +++--
drivers/gpu/drm/xe/xe_vm.c | 2 +-
drivers/gpu/drm/xe/xe_vm_madvise.c | 2 +-
4 files changed, 12 insertions(+), 11 deletions(-)
diff --git a/drivers/gpu/drm/xe/xe_pat.c b/drivers/gpu/drm/xe/xe_pat.c
index 2e7cb99ae87a..5001233d83f7 100644
--- a/drivers/gpu/drm/xe/xe_pat.c
+++ b/drivers/gpu/drm/xe/xe_pat.c
@@ -61,7 +61,7 @@ struct xe_pat_ops {
};
static const struct xe_pat_table_entry xelp_pat_table[] = {
- [0] = { XELP_PAT_WB, XE_COH_AT_LEAST_1WAY },
+ [0] = { XELP_PAT_WB, XE_COH_1WAY },
[1] = { XELP_PAT_WC, XE_COH_NONE },
[2] = { XELP_PAT_WT, XE_COH_NONE },
[3] = { XELP_PAT_UC, XE_COH_NONE },
@@ -71,19 +71,19 @@ static const struct xe_pat_table_entry xehpc_pat_table[] = {
[0] = { XELP_PAT_UC, XE_COH_NONE },
[1] = { XELP_PAT_WC, XE_COH_NONE },
[2] = { XELP_PAT_WT, XE_COH_NONE },
- [3] = { XELP_PAT_WB, XE_COH_AT_LEAST_1WAY },
+ [3] = { XELP_PAT_WB, XE_COH_1WAY },
[4] = { XEHPC_PAT_CLOS(1) | XELP_PAT_WT, XE_COH_NONE },
- [5] = { XEHPC_PAT_CLOS(1) | XELP_PAT_WB, XE_COH_AT_LEAST_1WAY },
+ [5] = { XEHPC_PAT_CLOS(1) | XELP_PAT_WB, XE_COH_1WAY },
[6] = { XEHPC_PAT_CLOS(2) | XELP_PAT_WT, XE_COH_NONE },
- [7] = { XEHPC_PAT_CLOS(2) | XELP_PAT_WB, XE_COH_AT_LEAST_1WAY },
+ [7] = { XEHPC_PAT_CLOS(2) | XELP_PAT_WB, XE_COH_1WAY },
};
static const struct xe_pat_table_entry xelpg_pat_table[] = {
[0] = { XELPG_PAT_0_WB, XE_COH_NONE },
[1] = { XELPG_PAT_1_WT, XE_COH_NONE },
[2] = { XELPG_PAT_3_UC, XE_COH_NONE },
- [3] = { XELPG_PAT_0_WB | XELPG_2_COH_1W, XE_COH_AT_LEAST_1WAY },
- [4] = { XELPG_PAT_0_WB | XELPG_3_COH_2W, XE_COH_AT_LEAST_1WAY },
+ [3] = { XELPG_PAT_0_WB | XELPG_2_COH_1W, XE_COH_1WAY },
+ [4] = { XELPG_PAT_0_WB | XELPG_3_COH_2W, XE_COH_2WAY },
};
/*
@@ -115,7 +115,7 @@ static const struct xe_pat_table_entry xelpg_pat_table[] = {
REG_FIELD_PREP(XE2_L4_POLICY, l4_policy) | \
REG_FIELD_PREP(XE2_COH_MODE, __coh_mode), \
.coh_mode = (BUILD_BUG_ON_ZERO(__coh_mode && comp_en) || __coh_mode) ? \
- XE_COH_AT_LEAST_1WAY : XE_COH_NONE \
+ __coh_mode : XE_COH_NONE \
}
static const struct xe_pat_table_entry xe2_pat_table[] = {
diff --git a/drivers/gpu/drm/xe/xe_pat.h b/drivers/gpu/drm/xe/xe_pat.h
index fa0dfbe525cd..290c4b810573 100644
--- a/drivers/gpu/drm/xe/xe_pat.h
+++ b/drivers/gpu/drm/xe/xe_pat.h
@@ -26,8 +26,9 @@ struct xe_pat_table_entry {
/**
* @coh_mode: The GPU coherency mode that @value maps to.
*/
-#define XE_COH_NONE 1
-#define XE_COH_AT_LEAST_1WAY 2
+#define XE_COH_NONE 1
+#define XE_COH_1WAY 2
+#define XE_COH_2WAY 3
u16 coh_mode;
};
diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
index 8f7b8f2da06b..b31859fec555 100644
--- a/drivers/gpu/drm/xe/xe_vm.c
+++ b/drivers/gpu/drm/xe/xe_vm.c
@@ -3368,7 +3368,7 @@ static int vm_bind_ioctl_check_args(struct xe_device *xe, struct xe_vm *vm,
goto free_bind_ops;
}
- if (XE_WARN_ON(coh_mode > XE_COH_AT_LEAST_1WAY)) {
+ if (XE_WARN_ON(coh_mode > XE_COH_2WAY)) {
err = -EINVAL;
goto free_bind_ops;
}
diff --git a/drivers/gpu/drm/xe/xe_vm_madvise.c b/drivers/gpu/drm/xe/xe_vm_madvise.c
index da306013a013..e4bcfeed2232 100644
--- a/drivers/gpu/drm/xe/xe_vm_madvise.c
+++ b/drivers/gpu/drm/xe/xe_vm_madvise.c
@@ -278,7 +278,7 @@ static bool madvise_args_are_sane(struct xe_device *xe, const struct drm_xe_madv
if (XE_IOCTL_DBG(xe, !coh_mode))
return false;
- if (XE_WARN_ON(coh_mode > XE_COH_AT_LEAST_1WAY))
+ if (XE_WARN_ON(coh_mode > XE_COH_2WAY))
return false;
if (XE_IOCTL_DBG(xe, args->pat_index.pad))
--
2.53.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH 6.18.y 3/3] drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR
2026-07-31 15:50 ` [PATCH 6.18.y 1/3] drm/xe/xe3p_lpg: flush shrinker bo cachelines manually Sasha Levin
2026-07-31 15:50 ` [PATCH 6.18.y 2/3] drm/xe/pat: define coh_mode 2way Sasha Levin
@ 2026-07-31 15:50 ` Sasha Levin
1 sibling, 0 replies; 4+ messages in thread
From: Sasha Levin @ 2026-07-31 15:50 UTC (permalink / raw)
To: stable
Cc: Jia Yao, Shuicheng Lin, Mathew Alwin, Michal Mrozek,
Matthew Brost, Matthew Auld, Rodrigo Vivi, Sasha Levin
From: Jia Yao <jia.yao@intel.com>
[ Upstream commit 662f9ddc8077792129440d05cbef2f944a07777a ]
Add validation in xe_vm_bind_ioctl() to reject PAT indices
with XE_COH_NONE coherency mode when used with
DRM_XE_VM_BIND_FLAG_CPU_ADDR_MIRROR.
CPU address mirror mappings use system memory that is CPU
cached, which makes them incompatible with COH_NONE PAT
indices. Allowing COH_NONE with CPU cached buffers is a
security risk, as the GPU may bypass CPU caches and read
stale sensitive data from DRAM.
Although CPU_ADDR_MIRROR does not create an immediate
mapping, the backing system memory is still CPU cached.
Apply the same PAT coherency restrictions as
DRM_XE_VM_BIND_OP_MAP_USERPTR.
v2:
- Correct fix tag
v6:
- No change
v7:
- Correct fix tag
v8:
- Rebase
v9:
- Limit the restrictions to iGPU
v10:
- Just add the iGPU logic but keep dGPU logic
Fixes: b43e864af0d4 ("drm/xe/uapi: Add DRM_XE_VM_BIND_FLAG_CPU_ADDR_MIRROR")
Cc: <stable@vger.kernel.org> # v6.15+
Cc: Shuicheng Lin <shuicheng.lin@intel.com>
Cc: Mathew Alwin <alwin.mathew@intel.com>
Cc: Michal Mrozek <michal.mrozek@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Matthew Auld <matthew.auld@intel.com>
Signed-off-by: Jia Yao <jia.yao@intel.com>
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Acked-by: Michal Mrozek <michal.mrozek@intel.com>
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Link: https://patch.msgid.link/20260417055917.2027459-3-jia.yao@intel.com
(cherry picked from commit 4d58d7535e826a3175527b6174502f0db319d7f6)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/xe/xe_vm.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
index b31859fec555..b09cfd5a4d20 100644
--- a/drivers/gpu/drm/xe/xe_vm.c
+++ b/drivers/gpu/drm/xe/xe_vm.c
@@ -3393,6 +3393,8 @@ static int vm_bind_ioctl_check_args(struct xe_device *xe, struct xe_vm *vm,
op == DRM_XE_VM_BIND_OP_MAP_USERPTR) ||
XE_IOCTL_DBG(xe, coh_mode == XE_COH_NONE &&
op == DRM_XE_VM_BIND_OP_MAP_USERPTR) ||
+ XE_IOCTL_DBG(xe, !IS_DGFX(xe) && coh_mode == XE_COH_NONE &&
+ is_cpu_addr_mirror) ||
XE_IOCTL_DBG(xe, op == DRM_XE_VM_BIND_OP_MAP_USERPTR &&
!IS_ENABLED(CONFIG_DRM_GPUSVM)) ||
XE_IOCTL_DBG(xe, obj &&
--
2.53.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-07-31 15:50 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-15 8:39 FAILED: patch "[PATCH] drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR" failed to apply to 6.18-stable tree gregkh
2026-07-31 15:50 ` [PATCH 6.18.y 1/3] drm/xe/xe3p_lpg: flush shrinker bo cachelines manually Sasha Levin
2026-07-31 15:50 ` [PATCH 6.18.y 2/3] drm/xe/pat: define coh_mode 2way Sasha Levin
2026-07-31 15:50 ` [PATCH 6.18.y 3/3] drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR Sasha Levin
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.